enip: make sure to have enough data for parser

ENIP parser makes use of nom's complete macros which by design expect
full data to be passed along to them. In case there is incomplete data
sent to them, they result in an error. This disables the ENIP parser and
further detection and could happen with an incomplete/fragmented
request/response.

Use AppLayerResult API to ask for more data from the stream engine in
case the stream slice currently at hand does not match the length
parameters received from the header or is not long enough to parse the
header itself.

Ticket: 8809

rust/src/enip/enip.rs

@@ -291,6 +291,15 @@ impl EnipState {
         }
         let mut start = input;
         while !start.is_empty() {
+            if start.len() < ENIP_HEADER_LEN as usize {
+                let consumed = (input.len() - start.len()) as u32;
+                return AppLayerResult::incomplete(consumed, ENIP_HEADER_LEN);
+            }
+            let pdulen = u16::from_le_bytes([start[2], start[3]]) as u32;
+            if (start.len() as u32) < ENIP_HEADER_LEN + pdulen {
+                let consumed = (input.len() - start.len()) as u32;
+                return AppLayerResult::incomplete(consumed, ENIP_HEADER_LEN + pdulen);
+            }
             match parser::parse_enip_pdu(start) {
                 Ok((rem, pdu)) => {
                     if !request {